   (log/info "Starting keycloak")
   (let [{:keys [issuer openid-config api-root] :as this} (init-keycloak (assoc data :credentials credentials :max-user-ids-cache max-user-ids-cache))
         http-timeout 10000
-        cm (http.conn-mgr/make-reusable-conn-manager {:timeout 2 :threads 3 :insecure? false :default-per-route 10})
-        openid-config (fetch-openid-configuration issuer {:timeout http-timeout :connection-manager cm})]
+        connection-manager (http.conn-mgr/make-reusable-conn-manager {:timeout 2 :threads 3 :insecure? false :default-per-route 10})
+        openid-config (fetch-openid-configuration issuer {:timeout http-timeout :connection-manager connection-manager})]
     (log/info "Successfully got openid-config from provider.")
     (assoc this
-           :cm cm
+           :connection-manager connection-manager
            :http-timeout http-timeout
            :openid-config openid-config)))
 
 (defmethod ig/halt-key! :akvo.lumen.component.keycloak/keycloak  [_ opts]
-  (log/info :keycloak "closing connection manager" (:cm opts))
-  (http.conn-mgr/shutdown-manager (:cm opts)))
+  (log/info :keycloak "closing connection manager" (:connection-manager opts))
+  (http.conn-mgr/shutdown-manager (:connection-manager opts)))
 
 
 (s/def ::client_id string?)

  remove the leading /akvo/lumen and return paths as demo/admin."
  ([keycloak email]
   (allowed-paths keycloak email {}))
  ([{:keys [api-root http-timeout user-id-cache cm] :as keycloak} email
    {:keys [timeout] :or {timeout http-timeout}}]
   (let [bare-req-opts {:timeout timeout}]
     (if-some [headers (request-headers keycloak (assoc bare-req-opts :timeout timeout))]
       (let [req-opts (assoc bare-req-opts :headers headers)]
         (when-let [user-id (lookup-user-id cm req-opts api-root user-id-cache email)]
           (when-let [allowed-paths
                    (-> (client/get (format "%s/users/%s/groups" api-root user-id)
                                    (assoc req-opts :connection-manager cm)) :body json/decode)]
             (reduce (fn [paths {:strs [path]}]
                       (conj paths (subs path 12)))
                     #{}

(defn request-headers
  "Create a set of request headers to use for interaction with the Keycloak
   REST API. This allows us to reuse the same token for multiple requests."
  ([{:keys [openid-config credentials connection-manager]}]
   (let [params (merge {:grant_type "client_credentials"}
                       credentials)
         resp (client/post (get openid-config "token_endpoint")
